Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2075c1c authored by Ken Chen's avatar Ken Chen
Browse files

Resume DNS tests suspended after T 

5 DNS tests were suspended on T+ devices because 3 Netd binder methods
they used were moved to the mainline module and no longer being
supported by Netd. To resume tests, this commit reimplements those
firewall methods in test utility.

Resumed tests:
- BlockDnsQueryWithUidRule
- GetAddrinfo_BlockDnsQueryWithUidRule
- EnforceDnsUid
- BlockDnsQueryUidDoesNotLeadToBadServer
- DnsWithVpn

Bug: 227159929
Test: atest resolv_integration_test
Change-Id: I459c1f1c79eb8caf5bab9092c27cab3a94db106e
parent 675d6730

tests/Android.bp

+7 −0
Original line number Diff line number Diff line
@@ -18,10 +18,16 @@ cc_test_library { 
    ],

    static_libs: [

        "netd_aidl_interface-lateststable-ndk",

        "libconnectivity_native_test_utils",

        "libmodules-utils-build",

        "libnetd_test_dnsresponder_ndk",

        "libnetdutils",

        "libgmock",

    ],

    export_static_lib_headers: [

        "libconnectivity_native_test_utils",

        "libmodules-utils-build",

    ],

}



cc_library_host_static {
@@ -185,6 +191,7 @@ cc_test { 
    ],

    static_libs: [

        "dnsresolver_aidl_interface-lateststable-ndk",

        "libconnectivity_native_test_utils",

        "libcrypto_static",

        "libgmock",

        "libmodules-utils-build",

tests/resolv_integration_test.cpp

+16 −14
Original line number Diff line number Diff line
@@ -4319,9 +4319,7 @@ TEST_F(ResolverTest, getDnsNetId) { 
    EXPECT_EQ(500, readResponseCode(fd));

}



// TODO(b/219434602): find an alternative way to block DNS packets on T+.

TEST_F(ResolverTest, BlockDnsQueryWithUidRule) {

    if (android::modules::sdklevel::IsAtLeastT()) GTEST_SKIP() << "T+ device.";

    SKIP_IF_BPF_NOT_SUPPORTED;

    constexpr char listen_addr1[] = "127.0.0.4";

    constexpr char listen_addr2[] = "::1";
@@ -4369,9 +4367,7 @@ TEST_F(ResolverTest, BlockDnsQueryWithUidRule) { 
    }

}



// TODO(b/219434602): find an alternative way to block DNS packets on T+.

TEST_F(ResolverTest, GetAddrinfo_BlockDnsQueryWithUidRule) {

    if (android::modules::sdklevel::IsAtLeastT()) GTEST_SKIP() << "T+ device.";

    SKIP_IF_BPF_NOT_SUPPORTED;

    constexpr char listen_addr1[] = "127.0.0.4";

    constexpr char listen_addr2[] = "::1";
@@ -4421,9 +4417,7 @@ TEST_F(ResolverTest, GetAddrinfo_BlockDnsQueryWithUidRule) { 
    }

}



// TODO(b/219434602): find an alternative way to block DNS packets on T+.

TEST_F(ResolverTest, EnforceDnsUid) {

    if (android::modules::sdklevel::IsAtLeastT()) GTEST_SKIP() << "T+ device.";

    SKIP_IF_BPF_NOT_SUPPORTED;

    constexpr char listen_addr1[] = "127.0.0.4";

    constexpr char listen_addr2[] = "::1";
@@ -6103,9 +6097,7 @@ TEST_F(ResolverTest, GetAddrInfoParallelLookupSleepTime) { 
    EXPECT_EQ(0U, GetNumQueries(dns, kHelloExampleCom));

}



// TODO(b/219434602): find an alternative way to block DNS packets on T+.

TEST_F(ResolverTest, BlockDnsQueryUidDoesNotLeadToBadServer) {

    if (android::modules::sdklevel::IsAtLeastT()) GTEST_SKIP() << "T+ device.";

    SKIP_IF_BPF_NOT_SUPPORTED;

    constexpr char listen_addr1[] = "127.0.0.4";

    constexpr char listen_addr2[] = "::1";
@@ -6975,7 +6967,11 @@ class ResolverMultinetworkTest : public ResolverTest { 
      public:

        ScopedVirtualNetwork(unsigned netId, ConnectivityType type, INetd* netdSrv,

                             IDnsResolver* dnsResolvSrv, const char* name, bool isSecure)

            : ScopedNetwork(netId, type, netdSrv, dnsResolvSrv, name), mIsSecure(isSecure) {}

            : ScopedNetwork(netId, type, netdSrv, dnsResolvSrv, name), mIsSecure(isSecure) {

            if (android::modules::sdklevel::IsAtLeastT()) {

                mFw = Firewall::getInstance();

            }

        }

        ~ScopedVirtualNetwork() {

            if (!mVpnIsolationUids.empty()) {

                const std::vector<int> tmpUids(mVpnIsolationUids.begin(), mVpnIsolationUids.end());
@@ -6984,15 +6980,22 @@ class ResolverMultinetworkTest : public ResolverTest { 
        }

        // Enable VPN isolation. Ensures that uid can only receive packets on mIfname.

        Result<void> enableVpnIsolation(int uid) {

            if (auto r = mNetdSrv->firewallAddUidInterfaceRules(mIfname, {uid}); !r.isOk()) {

            if (android::modules::sdklevel::IsAtLeastT()) {

                if (auto r = mFw->addUidInterfaceRules(mIfname, {uid}); !r.ok()) {

                    return r;

                }

            } else if (auto r = mNetdSrv->firewallAddUidInterfaceRules(mIfname, {uid}); !r.isOk()) {

                return Error() << r.getMessage();

            }

            mVpnIsolationUids.insert(uid);

            return {};

        }

        Result<void> disableVpnIsolation(int uid) {

            if (auto r = mNetdSrv->firewallRemoveUidInterfaceRules({static_cast<int>(uid)});

                !r.isOk()) {

            if (android::modules::sdklevel::IsAtLeastT()) {

                if (auto r = mFw->removeUidInterfaceRules({uid}); !r.ok()) {

                    return r;

                }

            } else if (auto r = mNetdSrv->firewallRemoveUidInterfaceRules({uid}); !r.isOk()) {

                return Error() << r.getMessage();

            }

            mVpnIsolationUids.erase(uid);
@@ -7021,6 +7024,7 @@ class ResolverMultinetworkTest : public ResolverTest { 


        bool mIsSecure = false;

        std::unordered_set<int> mVpnIsolationUids;

        Firewall* mFw;

    };



    void SetUp() override {
@@ -7354,9 +7358,7 @@ TEST_F(ResolverMultinetworkTest, OneCachePerNetwork) { 
    EXPECT_EQ(GetNumQueries(*dnsPair2->dnsServer, host_name), 1U);

}



// TODO(b/219434602): find an alternative way to block DNS packets on T+.

TEST_F(ResolverMultinetworkTest, DnsWithVpn) {

    if (android::modules::sdklevel::IsAtLeastT()) GTEST_SKIP() << "T+ device.";

    SKIP_IF_BPF_NOT_SUPPORTED;

    SKIP_IF_REMOTE_VERSION_LESS_THAN(mDnsClient.resolvService(), 4);

    constexpr char host_name[] = "ohayou.example.com.";

tests/resolv_test_utils.h

+24 −8
Original line number Diff line number Diff line
@@ -25,6 +25,8 @@ 


#include <aidl/android/net/INetd.h>

#include <android-base/properties.h>

#include <android-modules-utils/sdk_level.h>

#include <firewall.h>

#include <gtest/gtest.h>

#include <netdutils/InternetAddresses.h>
@@ -41,24 +43,38 @@ class ScopeBlockedUIDRule { 
        // this purpose because netd calls fchown() on the DNS query sockets, and "iptables -m

        // owner" matches the UID of the socket creator, not the UID set by fchown().

        // TODO: migrate FIREWALL_CHAIN_NONE to eBPF as well.

        EXPECT_TRUE(mNetSrv->firewallEnableChildChain(INetd::FIREWALL_CHAIN_STANDBY, true).isOk());

        if (android::modules::sdklevel::IsAtLeastT()) {

            mFw = Firewall::getInstance();

            EXPECT_RESULT_OK(mFw->toggleStandbyMatch(true));

            EXPECT_RESULT_OK(mFw->addRule(mTestUid, STANDBY_MATCH));

        } else {

            EXPECT_TRUE(

                    mNetSrv->firewallEnableChildChain(INetd::FIREWALL_CHAIN_STANDBY, true).isOk());

            EXPECT_TRUE(mNetSrv->firewallSetUidRule(INetd::FIREWALL_CHAIN_STANDBY, mTestUid,

                                                    INetd::FIREWALL_RULE_DENY)

                                .isOk());

        }

        EXPECT_TRUE(seteuid(mTestUid) == 0);

    };

    ~ScopeBlockedUIDRule() {

        // Restore uid

        EXPECT_TRUE(seteuid(mSavedUid) == 0);

        // Remove drop rule for testUid, and disable the standby chain.

        if (android::modules::sdklevel::IsAtLeastT()) {

            EXPECT_RESULT_OK(mFw->removeRule(mTestUid, STANDBY_MATCH));

            EXPECT_RESULT_OK(mFw->toggleStandbyMatch(false));

        } else {

            EXPECT_TRUE(mNetSrv->firewallSetUidRule(INetd::FIREWALL_CHAIN_STANDBY, mTestUid,

                                                    INetd::FIREWALL_RULE_ALLOW)

                                .isOk());

        EXPECT_TRUE(mNetSrv->firewallEnableChildChain(INetd::FIREWALL_CHAIN_STANDBY, false).isOk());

            EXPECT_TRUE(

                    mNetSrv->firewallEnableChildChain(INetd::FIREWALL_CHAIN_STANDBY, false).isOk());

        }

    }



  private:

    INetd* mNetSrv;

    Firewall* mFw;

    const uid_t mTestUid;

    const uid_t mSavedUid;

};